CVE-2024-6356

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-286

Affected software

VendorProductVersions
GitLabGitLab>= 16.0, < 17.0.6; >= 17.1, < 17.1.4; >= 17.2, < 17.2.2

References

Timeline

Published
Feb 5, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-63578.8Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence.CVE-2024-63588.8Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence.CVE-2024-63599.8Privilege escalation vulnerability identified in OpenText ArcSight Intelligence.CVE-2024-63609.8Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthoriCVE-2024-63615.4Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane. The vulnerability affects all version prior to versCVE-2024-63624.6The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting theCVE-2024-63635.4The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions uCVE-2024-63646.4A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both phCVE-2024-63659.8The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saCVE-2024-63669.1The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media CVE-2024-63675.4A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file CVE-2024-63685.4A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file
CVE-2024-6356: Medium severity, CVSS 4.4 | Vulnix